Hacker News Reader

Apple has good reasons to allow this. Inside a corporate network for example you may not want DNS queries going to Apple’s servers.

So Apple has made it very easy for a network admin to disable private relay. All an admin needs to do is blocking name lookups for relay.Apple.com*

*I don’t recall the actual DN used, it’s in Apple’s docs if you are curious.

View on HN

Apple still shouldn't make it so easy to block this wholesale, even on corporate networks. Instead, they should have a way to make only corporate-internal traffic not go through it.

The OS should be able to distinguish between a corporate network and mobile carrier, right?

It can, but if mask.icloud.com is where the relay connection needs to go that wouldn’t help.

Reply on news.ycombinator.com